bf9d98a0d5
- Upgrade registry to 3.0.0 (new config path, redis addrs) - Generate htpasswd with bcrypt cost 5; cost 12 added ~350ms per request - Route /v2 straight to the registry instead of through the UI's nginx Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
78 lines
2.5 KiB
YAML
78 lines
2.5 KiB
YAML
version: "{{ compose_version }}"
|
|
|
|
services:
|
|
redis:
|
|
image: redis:latest
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 256M
|
|
|
|
registry:
|
|
image: registry:3.0.0
|
|
secrets:
|
|
- source: htpasswd_{{ registry_htpasswd.stat.checksum }}
|
|
target: /etc/docker/registry/htpasswd
|
|
configs:
|
|
- source: registry_{{ registry_config.checksum }}
|
|
target: /etc/distribution/config.yml
|
|
environment:
|
|
- REGISTRY_STORAGE_DELETE_ENABLED=true
|
|
deploy:
|
|
placement:
|
|
constraints:
|
|
- node.role == manager
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.{{ service }}-api.rule=Host(`{{ service }}.{{ main_domain }}`) && PathPrefix(`/v2`)
|
|
- traefik.http.routers.{{ service }}-api.priority=100
|
|
- traefik.http.routers.{{ service }}-api.tls=true
|
|
- traefik.http.routers.{{ service }}-api.tls.certresolver=lets-encrypt
|
|
- traefik.http.routers.{{ service }}-api.service={{ service }}-api
|
|
- traefik.http.services.{{ service }}-api.loadbalancer.server.port=5000
|
|
networks: ['{{ ingress_network }}', 'default']
|
|
|
|
ui:
|
|
image: joxit/docker-registry-ui:2.5.6
|
|
environment:
|
|
- DELETE_IMAGES=true
|
|
- REGISTRY_TITLE=Kadet's private registry
|
|
- NGINX_PROXY_PASS_URL=http://registry:5000
|
|
- SINGLE_REGISTRY=true
|
|
depends_on: ['registry']
|
|
deploy:
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.{{ service }}.rule=Host(`{{ service }}.{{ main_domain }}`)
|
|
- traefik.http.routers.{{ service }}.tls=true
|
|
- traefik.http.routers.{{ service }}.tls.certresolver=lets-encrypt
|
|
- traefik.http.services.{{ service }}.loadbalancer.server.port=80
|
|
networks: ['{{ ingress_network }}', 'default']
|
|
|
|
image-cleanup-job:
|
|
image: registry:3.0.0
|
|
command: ["registry", "garbage-collect", "/etc/distribution/config.yml", "-m"]
|
|
secrets:
|
|
- source: htpasswd_{{ registry_htpasswd.stat.checksum }}
|
|
target: /etc/docker/registry/htpasswd
|
|
configs:
|
|
- source: registry_{{ registry_config.checksum }}
|
|
target: /etc/distribution/config.yml
|
|
deploy:
|
|
placement:
|
|
constraints:
|
|
- node.role == manager
|
|
labels:
|
|
- "swarm.cronjob.enable=true"
|
|
- "swarm.cronjob.schedule=0 0 0 1 * *"
|
|
restart_policy:
|
|
condition: none
|
|
|
|
configs:
|
|
registry_{{ registry_config.checksum }}:
|
|
file: ./config/config.yml
|
|
|
|
secrets:
|
|
htpasswd_{{ registry_htpasswd.stat.checksum }}:
|
|
file: ./config/htpasswd
|